@impeccable/reviews 0.1.3 → 0.1.4

package/dist/tools.js

@@ -7,7 +7,7 @@ import { request } from 'node:http';
 import { createServer } from 'node:net';
 import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { defineTool } from '@earendil-works/pi-coding-agent';
-import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment } from './fence.js';
+import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment } from './fence.js';
 import { requestJson } from './http.js';
 import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
 import { HOST_QUESTIONS, HOST_SCREENS } from './host-questions.js';
@@ -16,7 +16,7 @@ import { cfRunner, pagesProject, readCloudflarePreviews } from './cloudflare.js'
 import { passCloudflareAccess } from './cloudflare-access.js';
 import { commandRunner, connectNetlifySite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
 import { basicCredentials, PASSWORD_HEADER, passNetlifyLock } from './netlify-password.js';
-import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, vercelStatus, vercelTeams, waitForVercelAccess } from './vercel.js';
+import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, vercelProjectPage, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
 import { BYPASS_HEADER, passVercelLogin, readLink } from './vercel-bypass.js';
 import { fitsTask, stagesOf } from './stages.js';
 import { redact } from './log.js';
@@ -1419,26 +1419,37 @@ export function createTools(ctx) {
     /** The host whose preview a proof answered with this app, and the one whose previews impeccable_write then saved as the method. */
     let provenHost;
     let savedHost;
+    /** Whether the repository's last saved method is a host's previews, and whether any write named an app: a monorepo's apps each go their own way, and only a run whose host builds them all opens no workflow and no setup pull request. */
+    let hostMethod = false;
+    let perApp = false;
     /**
      * A host's build, waited for on the screen as the task in progress, naming `host`, with the time so far: `read` again
      * every so often until `built` says the evidence is final, or the wait runs out. The status line names the host and what it builds.
      */
-    async function awaitBuild(host, status, read, built, signal) {
-        let evidence = await read();
-        if (built(evidence))
-            return evidence;
+    async function awaitBuild(host, status, read, built, page, signal) {
+        const first = await read();
+        if (built(first))
+            return first;
         const wait = ctx.previewWait ?? { totalMs: 300_000, everyMs: 15_000 };
-        said(status);
-        reportWait({ since: Date.now(), host });
-        try {
-            for (const end = Date.now() + wait.totalMs; !built(evidence) && Date.now() < end; evidence = await read()) {
-                await sleep(wait.everyMs, undefined, { signal });
+        const waited = async (evidence) => {
+            said(status);
+            reportWait({ since: Date.now(), host });
+            try {
+                for (const end = Date.now() + wait.totalMs; !built(evidence) && Date.now() < end; evidence = await read()) {
+                    await sleep(wait.everyMs, undefined, { signal });
+                }
             }
-        }
-        finally {
-            reportWait(null);
-        }
-        return evidence;
+            finally {
+                reportWait(null);
+            }
+            return evidence;
+        };
+        // No build in the time: the host's page where a build is turned on, and the wait again on the person's yes.
+        return onHostPage(`${host.toLowerCase()}-build`, page, (e) => !built(e), await waited(first), async () => waited(await read()), {
+            skipped: `The person stopped waiting for ${host}'s build.`,
+            still: `${host} built no preview in the time.`,
+            stopped: `The run stopped while ${host}'s build was waited for.`,
+        }, signal);
     }
     /** What a wait for a pull request's build is for: the test drive's preview, or another pull request's. */
     const subjectOf = async (pull) => {
@@ -1458,7 +1469,7 @@ export function createTools(ctx) {
     /** The Netlify site password saved in this run, for the proof of that site's addresses to send; never for the model. It is one site's, so it goes only to that site's deploy previews. */
     let sitePassword;
     const passwordSites = new Set();
-    /** What impeccable_netlify_password answered for a site, less the password, where the answer stands for the run: a skip is asked once, and the team login stays. Another site of the repository is read on its own. */
+    /** What impeccable_netlify_password answered for a site, less the password, where the answer stands for the run: a skip is asked once, the team login kept after the retries stays, and a site made public stays public. Another site of the repository is read on its own. */
     const passwordStands = new Map();
     /** The sites whose password the person said yes to storing: a later call for the same site, after a page the app's own sign-in answered, asks no second time. */
     const passwordConsented = new Set();
@@ -1542,6 +1553,9 @@ export function createTools(ctx) {
         endHostSetup(ctx.log, host);
     };
     const HOST_NAMES = { netlify: 'Netlify', vercel: 'Vercel' };
+    /** The Vercel project and the Netlify site this run set up, by name, for the pages of theirs a screen opens. */
+    let vercelProject;
+    let netlifySite;
     const hostCli = (host, pi, signal) => {
         const runner = (browser = false) => (ctx.hostRunner ?? commandRunner)(host, pi.cwd, { signal, browser, timeoutMs: browser ? 300_000 : 30_000 });
         const cli = runner();
@@ -1622,25 +1636,37 @@ export function createTools(ctx) {
         }
     }
     /**
-     * The one-time access a host's GitHub app needs when it cannot reach the repository: a screen that opens the app's page
-     * on GitHub, a wait of up to five minutes for the host to reach it (`reaches`, tried again every so often), a retry
-     * screen, and after two failed retries the connection left to the person.
+     * What the person does on a host's page, asked in the run: the screen `screen` (then `<screen>-retry`) opens the page,
+     * `again` waits up to five minutes for it to be done, trying every so often, and after two failed retries the step is
+     * left undone with `words.still`. `pending` says it is not done yet; the run carries on either way.
      */
-    async function hostAccess(host, result, reaches, signal) {
-        const name = HOST_NAMES[host];
-        for (let retries = 0; result.access && !signal?.aborted; retries++) {
-            if ((await ask(HOST_SCREENS[retries ? `${host}-access-retry` : `${host}-access`])).skipped)
-                return { ...result, reason: `The person skipped giving ${name}'s GitHub app access to the repository.` };
-            (ctx.openBrowser ?? openBrowser)(result.access);
-            said(`Waiting for ${name} to reach the repository`);
-            result = await reaches();
+    async function onHostPage(screen, page, pending, result, again, words, signal) {
+        for (let retries = 0; pending(result) && !signal?.aborted; retries++) {
+            if ((await ask(HOST_SCREENS[retries ? `${screen}-retry` : screen])).skipped)
+                return { ...result, reason: words.skipped };
+            const at = page(result);
+            if (at)
+                (ctx.openBrowser ?? openBrowser)(at);
+            if (words.waiting)
+                said(words.waiting);
+            result = await again(result);
             if (signal?.aborted)
-                return { ...result, reason: `The run stopped while ${name} was waited for.` };
-            if (result.access && retries === 2)
-                return { ...result, reason: `${name}'s GitHub app still cannot reach the repository.` };
+                return { ...result, reason: words.stopped };
+            if (pending(result) && retries === 2)
+                return { ...result, reason: words.still };
         }
         return result;
     }
+    /** The one-time access a host's GitHub app needs when it cannot reach the repository, given on the app's page on GitHub while `reaches` tries again. */
+    function hostAccess(host, result, reaches, signal) {
+        const name = HOST_NAMES[host];
+        return onHostPage(`${host}-access`, (r) => r.access, (r) => Boolean(r.access), result, reaches, {
+            waiting: `Waiting for ${name} to reach the repository`,
+            skipped: `The person skipped giving ${name}'s GitHub app access to the repository.`,
+            still: `${name}'s GitHub app still cannot reach the repository.`,
+            stopped: `The run stopped while ${name} was waited for.`,
+        }, signal);
+    }
     /** The connection of the linked Netlify site with this repository, through Netlify's site settings and its GitHub app, with the app's access asked when it cannot read the repository. */
     async function netlifyConnect(pi, settings, signal) {
         // The site's settings change on the host: only once the person opened the Netlify setup, as the fence holds for the CLI.
@@ -1650,6 +1676,7 @@ export function createTools(ctx) {
         const gh = (ctx.hostRunner ?? commandRunner)('gh', pi.cwd, { signal });
         const clone = ctx.hostWait?.clone;
         const result = await connectNetlifySite(ctx.owner, ctx.repo, pi.cwd, { netlify, gh, settings, signal, ...(clone ? { wait: clone } : {}) });
+        netlifySite = result.site?.name ?? netlifySite;
         // A build every 30 s until one reads the repository: the person is giving the app access meanwhile.
         return hostAccess('netlify', result, async () => (await waitForNetlifyAccess(result.site.id, { netlify, signal, wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 30_000 }, ...(clone ? { clone } : {}) })
             ? { connected: true, site: result.site, how: 'github-app' } : result), signal);
@@ -1673,7 +1700,18 @@ export function createTools(ctx) {
                 settleVercelFirstDeployment(ctx.log, { projectId: link?.projectId ?? null, how: 'connection' });
             return result;
         }
-        const first = link ? await prepareFirstDeployment(vercel, link) : { production: 'unknown', locked: false, reason: 'This folder is linked to no Vercel project (.vercel/project.json): run vercel link first.' };
+        let first = link ? await prepareFirstDeployment(vercel, link) : { production: 'unknown', locked: false, reason: 'This folder is linked to no Vercel project (.vercel/project.json): run vercel link first.' };
+        vercelProject = first.project ?? vercelProject;
+        // Vercel refused the lock: the person turns it on in the project's settings, in this run, and the read sees it.
+        if (link && first.production === 'none' && !first.locked) {
+            const page = vercelProjectPage('settings/deployment-protection', chosenHostTeam(ctx.log, 'vercel'), vercelProject);
+            first = await onHostPage('vercel-lock', () => page, (f) => f.production !== 'exists' && !f.locked, first, () => waitForVercelLock(vercel, link, { wait: ctx.hostWait?.access ?? { totalMs: 300_000, everyMs: 10_000 }, signal }), {
+                waiting: "Waiting for Vercel's login on the project",
+                skipped: 'The person skipped locking the Vercel project.',
+                still: "Vercel's login is still not in front of the project's addresses.",
+                stopped: 'The run stopped while the lock was waited for.',
+            }, signal);
+        }
         if (link && (first.production === 'exists' || first.locked === true))
             settleVercelFirstDeployment(ctx.log, { projectId: link.projectId, how: 'project' });
         return { ...result, ...first };
@@ -1862,6 +1900,10 @@ export function createTools(ctx) {
                     retry.requireHistory = true;
                 if (object(p.body)?.intendedMethod === 'preview-deploy')
                     savedHost = provenHost;
+                if (saved?.appKey !== undefined)
+                    perApp = true;
+                if (saved && 'intendedMethod' in saved)
+                    hostMethod = saved.intendedMethod === 'preview-deploy';
                 for (const key of Object.keys(object(p.body) ?? {}))
                     if (PREVIEW_FIELDS.has(key) && keys?.[key] === 'stored')
                         previews.changes.add(key);
@@ -1921,12 +1963,16 @@ export function createTools(ctx) {
             typed.set(reference, (q.kind === 'account' ? answer.password : answer.value) ?? '');
             return JSON.stringify(q.kind === 'account' ? { username: answer.username ?? '', password: reference } : { value: reference });
         }),
-        tool('impeccable_progress', 'Progress', 'Show the person where things stand, here and on the web page: the [STATUS] line and the whole task list. It refuses, saving nothing, a status line out of the playbook\'s voice, more than one task in progress, and a status line about another task than the one in progress.', PROGRESS, async (p) => {
+        tool('impeccable_progress', 'Progress', 'Show the person where things stand, here and on the web page: the [STATUS] line and the whole task list. It refuses, saving nothing, a status line out of the playbook\'s voice, more than one task in progress, a status line about another task than the one in progress, and a Preview workflow or Setup pull request task once a host\'s previews are the method.', PROGRESS, async (p) => {
             const status = p.status.trim();
             const tasks = withAttempts(p.tasks);
-            const voice = statusVoiceError(status) ?? stageError(status, p.tasks.filter((t) => !t.id.startsWith('preview-attempt-')));
+            const own = p.tasks.filter((t) => !t.id.startsWith('preview-attempt-'));
+            const voice = statusVoiceError(status) ?? stageError(status, own);
             if (voice)
                 return voice;
+            const unneeded = hostMethod && !perApp && !ctx.sync.payload.setup_pr ? own.filter((t) => /\bsetup pull request\b/i.test(t.title) || stagesOf(t.title).includes('Preview workflow')) : [];
+            if (unneeded.length)
+                return `Refused: ${savedHost ?? 'the host'} builds this run's previews, so the repository needs no workflow and no setup pull request. Leave ${unneeded.map((t) => `"${t.title}"`).join(' and ')} off the list: a task the run never does is not shown, not even as skipped. Nothing was saved: call impeccable_progress again.`;
             ctx.sync.update({ phase: 'running', status, tasks });
             reportStatus(status);
             reportTasks(tasks);
@@ -1979,16 +2025,17 @@ export function createTools(ctx) {
                 if (!left.includes('Watch the review on the test drive'))
                     left.push('Watch the review on the test drive');
             }
-            const { phase, status, question, report_markdown, test_pr } = ctx.sync.payload;
+            const { phase, status, question, report_markdown, test_pr, left: leftBefore } = ctx.sync.payload;
             // A test drive branched before the setup branch was corrected ran on the old head: it shows nothing about this one.
             const covered = test_pr && recordedBranches?.setup
                 ? await (ctx.driveCoversSetup ?? driveCoversSetup)(pi.cwd, recordedBranches.setup, recordedBranches.drive) : null;
             const drive = covered === false ? undefined : test_pr;
-            ctx.sync.update({ phase: 'completed', status: 'Setup finished', question: null, report_markdown: markdown, test_pr: drive });
+            // The web page lists what is left too, within the Worker's 20 lines (REPORT and the check above keep each line non-empty and short).
+            ctx.sync.update({ phase: 'completed', status: 'Setup finished', question: null, report_markdown: markdown, test_pr: drive, left: left.slice(0, 20) });
             const res = await ctx.sync.flush();
             if (res && res.status >= 400 && res.status < 500) {
                 // A definite no: the run is still open on the server, so the session goes back to what it was and the agent can send the report again.
-                ctx.sync.update({ phase, status, question, report_markdown, test_pr });
+                ctx.sync.update({ phase, status, question, report_markdown, test_pr, left: leftBefore });
                 return `Error: the report was refused (${res.status}: ${res.error}). Fix what it says and call impeccable_report again.`;
             }
             // Otherwise final: a completed write whose answer was lost may still have landed, so it is never taken back.
@@ -1997,7 +2044,7 @@ export function createTools(ctx) {
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
         }),
-        tool('impeccable_hosted_previews', 'Hosted previews', 'Read the deployments GitHub has on record for this repository: the 20 newest, each with its latest status, its address, its environment, whether Vercel made it and the pull requests whose commit it built. An error says nothing either way. With branch (a branch of this run, pushed, before its pull request exists), only its head\'s, waiting up to five minutes for Vercel\'s deployment of it to finish building, under a status line with its timer. A Production deployment of that branch (a project\'s first is, whatever branch it builds) is listed as its preview only while the project this folder is linked to is locked at every address (impeccable_vercel_connect locks it) and made it, read from Vercel at that moment, since a production deployment is otherwise served at the project\'s own address without a login; then no proof opens it. It changes nothing on the host and proves nothing about the page.', HOSTED_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_hosted_previews', 'Hosted previews', 'Read the deployments GitHub has on record for this repository: the 20 newest, each with its latest status, its address, its environment, whether Vercel made it and the pull requests whose commit it built. An error says nothing either way. With branch (a branch of this run, pushed, before its pull request exists), only its head\'s, waiting up to five minutes for Vercel\'s deployment of it to finish building, under a status line with its timer, and again on the person\'s yes when the time ran out. A Production deployment of that branch (a project\'s first is, whatever branch it builds) is listed as its preview only while the project this folder is linked to is locked at every address (impeccable_vercel_connect locks it) and made it, read from Vercel at that moment, since a production deployment is otherwise served at the project\'s own address without a login; then no proof opens it. It changes nothing on the host and proves nothing about the page.', HOSTED_PREVIEWS, async (p, pi, signal) => {
             const branch = p.branch;
             const read = () => (ctx.hostedPreviewReader ?? readHostedPreviews)(ctx.owner, ctx.repo, { signal, branch });
             // With `branch` the evidence holds only the deployments of its head, and Vercel's is its build whatever environment it is called: the first deployment of a
@@ -2006,7 +2053,7 @@ export function createTools(ctx) {
             const ofBranch = (d) => (branch !== undefined ? d.vercel : isPreview(d));
             // A head's build is still building until it has a final status.
             const final = (evidence) => Boolean(evidence.error) || evidence.deployments.some((d) => ofBranch(d) && (d.state === 'success' || d.state === 'failure' || d.state === 'error'));
-            const evidence = branch !== undefined ? await awaitBuild('Vercel', `Waiting for Vercel to build ${testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`}`, read, final, signal) : await read();
+            const evidence = branch !== undefined ? await awaitBuild('Vercel', `Waiting for Vercel to build ${testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`}`, read, final, () => vercelProjectPage('settings/git', chosenHostTeam(ctx.log, 'vercel'), vercelProject), signal) : await read();
             listedPreviews.clear();
             vercelMade.clear();
             publicProduction.clear();
@@ -2033,20 +2080,25 @@ export function createTools(ctx) {
             }
             return JSON.stringify(evidence);
         }),
-        tool('impeccable_netlify_previews', 'Netlify previews', "Read whether this repository's pull requests get Netlify deploy previews: the 10 newest, each with its site, its address, its state and where that was read: GitHub's commit status or Netlify's bot comment on the pull request, or the Netlify CLI on this machine when it is signed in (read only: it never signs in). cli says whether that CLI is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent. With pull (a pull request of this run, a draft included: Netlify builds a deploy preview only for a pull request), only that pull request's, waiting up to five minutes for one to finish building, under a status line with its timer. It changes nothing on Netlify and proves nothing about the page.", NETLIFY_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_netlify_previews', 'Netlify previews', "Read whether this repository's pull requests get Netlify deploy previews: the 10 newest, each with its site, its address, its state and where that was read: GitHub's commit status or Netlify's bot comment on the pull request, or the Netlify CLI on this machine when it is signed in (read only: it never signs in). cli says whether that CLI is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent. With pull (a pull request of this run, a draft included: Netlify builds a deploy preview only for a pull request), only that pull request's, waiting up to five minutes for one to finish building, under a status line with its timer, and again on the person's yes when the time ran out. It changes nothing on Netlify and proves nothing about the page.", NETLIFY_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
             const read = () => (ctx.netlifyPreviewReader ?? readNetlifyPreviews)(ctx.owner, ctx.repo, pi.cwd, { signal, pull });
             // A pull request's preview is still building until Netlify's deploy of it is built or has failed.
             const states = ['success', 'ready', 'failure', 'error'];
             const final = (evidence) => Boolean(evidence.error) || evidence.previews.some((preview) => states.includes(preview.state ?? ''));
-            const evidence = pull !== undefined ? await awaitBuild('Netlify', `Waiting for Netlify to build ${await subjectOf(pull)}`, read, final, signal) : await read();
+            const evidence = pull !== undefined ? await awaitBuild('Netlify', `Waiting for Netlify to build ${await subjectOf(pull)}`, read, final, (e) => {
+                // The waited pull request's own site; else the one site known, so another app's site never opens.
+                const known = new Set([...e.sites, ...(netlifySite ? [netlifySite] : [])]);
+                const site = e.previews.find((preview) => preview.pullRequest === pull)?.site ?? (known.size === 1 ? [...known][0] : undefined);
+                return site ? `https://app.netlify.com/projects/${encodeURIComponent(site)}/configuration/deploys#deploy-previews` : 'https://app.netlify.com/';
+            }, signal) : await read();
             netlifyListed.clear();
             for (const p of evidence.previews)
                 if (p.state === 'success' || p.state === 'ready')
                     netlifyListed.add(new URL(p.url).origin);
             return JSON.stringify(evidence);
         }),
-        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in). cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
+        tool('impeccable_cloudflare_previews', 'Cloudflare Pages previews', "Read whether this repository's pull requests get Cloudflare Pages previews: the 10 newest, each with its address, the branch's alias (https://<branch>.<project>.pages.dev, which follows the branch's latest build), its state and where that was read: the check run or the pull request comment Cloudflare's GitHub app posts, or cf, Cloudflare's CLI, on this machine when it is signed in (read only: it never signs in). cli says whether cf is missing, signed out, signed in or did not answer. An error says something could not be read, which is unknown rather than absent, and unread says whose: GitHub or cf. With pull (a pull request of this run) or branch (a branch of this run, pushed, before its pull request exists), only that one's, waiting up to five minutes for its build to finish, under a status line with its timer, and again on the person's yes when the time ran out. It changes nothing on Cloudflare and proves nothing about the page.", CLOUDFLARE_PREVIEWS, async (p, pi, signal) => {
             const pull = p.pull;
             const branch = p.branch;
             if (pull !== undefined && branch !== undefined)
@@ -2056,7 +2108,7 @@ export function createTools(ctx) {
             // GitHub's record unread ends the wait; cf's alone does not, since the check run still says when the build ends.
             const final = (evidence) => Boolean(evidence.unread?.includes('GitHub')) || evidence.previews.some((preview) => preview.state !== 'building');
             const subject = branch !== undefined ? (testDriveBranch(branch) ? "the test drive's preview" : `the preview of ${branch}`) : pull !== undefined ? await subjectOf(pull) : '';
-            const evidence = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, signal) : await read();
+            const evidence = subject ? await awaitBuild('Cloudflare', `Waiting for Cloudflare Pages to build ${subject}`, read, final, () => 'https://dash.cloudflare.com/?to=/:account/workers-and-pages', signal) : await read();
             cloudflareListed.clear();
             for (const preview of evidence.previews) {
                 if (preview.state !== 'success')
@@ -2103,7 +2155,7 @@ export function createTools(ctx) {
                 return 'Refused: publish is a folder relative to the checkout, such as "dist".';
             return JSON.stringify(await netlifyConnect(pi, { command, publish }, signal));
         }),
-        tool('impeccable_vercel_connect', 'Connect the repository to Vercel', "Connect the Vercel project this folder is linked to with this repository (vercel git connect), so that pull requests get preview deployments, and lock a project that has no production deployment yet: Vercel makes a new project's first deployment Production, whatever branch it builds, and serves it at the project's own address, so this puts Vercel's login in front of every address of the project (Deployment Protection on All Deployments) before anything is pushed; the fence holds every push until this settled the first deployment. The run does it; when Vercel's GitHub app cannot reach the repository, this asks the person once for its access on GitHub and waits. connected true means the repository is connected, or was already; production \"exists\" means the project deploys production already, so a push of another branch is a Preview; locked true means every address of the project is behind Vercel's login, so its first deployment is no public build; locked false, with reason, means push nothing. A connection left undone answers why, and the GitHub page for the person in access.", NO_INPUT, async (_p, pi, signal) => JSON.stringify(await vercelConnect(pi, signal))),
+        tool('impeccable_vercel_connect', 'Connect the repository to Vercel', "Connect the Vercel project this folder is linked to with this repository (vercel git connect), so that pull requests get preview deployments, and lock a project that has no production deployment yet: Vercel makes a new project's first deployment Production, whatever branch it builds, and serves it at the project's own address, so this puts Vercel's login in front of every address of the project (Deployment Protection on All Deployments) before anything is pushed; the fence holds every push until this settled the first deployment. The run does it; when Vercel's GitHub app cannot reach the repository, this asks the person once for its access on GitHub and waits, and when Vercel refuses the lock, it asks the person once to turn it on in the project's settings and waits. connected true means the repository is connected, or was already; production \"exists\" means the project deploys production already, so a push of another branch is a Preview; locked true means every address of the project is behind Vercel's login, so its first deployment is no public build; locked false, with reason, means push nothing. A connection left undone answers why, and the GitHub page for the person in access.", NO_INPUT, async (_p, pi, signal) => JSON.stringify(await vercelConnect(pi, signal))),
         tool('impeccable_vercel_bypass', "Vercel's login", 'Get past the Vercel login that impeccable_prove_preview met (gate "vercel-protection") in front of a preview Vercel made, the way Vercel documents for tools: a bypass secret of the Vercel project, sent to it in a header. It does the rest with the Vercel CLI signed in as the person: it finds the project\'s secret labelled "Impeccable reviews", or shows one screen asking to create one, or, when the CLI cannot, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; secret says whether it was created, existing or typed, and project which Vercel project holds it), skipped (the person skipped the screen; reason says what came before), refused (no secret opened the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No secret ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             if (gated?.gate !== 'vercel-protection' || !vercelMade.has(new URL(gated.url).origin))
                 return 'Refused: this is for a preview that Vercel made, listed by impeccable_hosted_previews, which impeccable_prove_preview answered with gate "vercel-protection". Prove one first.';
@@ -2123,6 +2175,8 @@ export function createTools(ctx) {
                 link: () => readLink(pi.cwd),
                 consent: async () => !(await ask(HOST_SCREENS['vercel-bypass'])).skipped,
                 paste: async () => {
+                    // The locked preview may be another project's than the one this run connected, so the person picks the project.
+                    (ctx.openBrowser ?? openBrowser)(vercelProjectPage('settings/deployment-protection'));
                     const answer = await ask(HOST_SCREENS['vercel-bypass-key']);
                     return answer.skipped ? undefined : answer.value?.trim();
                 },
@@ -2152,13 +2206,10 @@ export function createTools(ctx) {
             }
             return JSON.stringify(bypassOutcome);
         }),
-        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, the one way a request can carry Netlify\'s site password: as basic credentials in the Authorization header. It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify; for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when the CLI cannot read the site or Netlify does not give the password back, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), login (Netlify\'s team login stands in front, which no tool gets past: protection says so, and reason why), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, the one way a request can carry Netlify\'s site password: as basic credentials in the Authorization header. It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify; for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when the CLI cannot read the site or Netlify does not give the password back, one screen taking a pasted one; opens the preview with it; and saves it for reviews. For a site behind Netlify\'s team login it shows one screen asking to make the site public, makes it public as the person, and where Netlify refuses opens Netlify\'s Visitor access page with a screen to try again once the person changed it there. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), opened (the site is public and the preview proven, so the method may be saved; madePublic says whether the run or the person made it public, and on any other answer that the run made it public all the same), login (Netlify kept its team login in front after the retries; reason says so), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             const site = gated?.gate === 'netlify-protection' ? netlifySiteOf(gated.url) : null;
             if (!gated || !site)
                 return 'Refused: this is for a Netlify deploy preview, listed by impeccable_netlify_previews, which impeccable_prove_preview answered with gate "netlify-protection". Prove one first.';
-            const stands = passwordStands.get(site);
-            if (stands)
-                return JSON.stringify(stands);
             const at = gated;
             /** The address pattern the proof with the password answers, saved as the method once the password is. */
             let pattern;
@@ -2168,6 +2219,17 @@ export function createTools(ctx) {
                     pattern = proof.pattern;
                 return proof;
             };
+            const stands = passwordStands.get(site);
+            if (stands?.status === 'opened') {
+                // A site made public stands while the address opens with nothing sent; behind the login again, it is read again.
+                if ((await prove(undefined)).proven) {
+                    provenPattern = pattern ?? provenPattern;
+                    return JSON.stringify(stands);
+                }
+                passwordStands.delete(site);
+            }
+            else if (stands)
+                return JSON.stringify(stands);
             // A password in hand already: another deploy preview of the same site opens with it. Another site's lock is read for that site.
             if (passwordSaved && sitePassword && passwordSites.has(site) && (await prove(sitePassword)).proven) {
                 provenPattern = pattern ?? provenPattern;
@@ -2183,6 +2245,14 @@ export function createTools(ctx) {
                         return passwordConsented.add(site), true;
                     return false;
                 },
+                makePublic: async () => !(await ask(HOST_SCREENS['netlify-visibility'])).skipped,
+                retry: async (page, first) => {
+                    if (first)
+                        (ctx.openBrowser ?? openBrowser)(page);
+                    // The browser may not have opened (BROWSER=none, no opener): the address is on the screen as well.
+                    const screen = HOST_SCREENS['netlify-visibility-retry'];
+                    return !(await ask({ ...screen, hint: `${screen.hint} If it did not open, open this link: ${page}` })).skipped;
+                },
                 paste: async () => {
                     const answer = await ask(HOST_SCREENS['netlify-password-key']);
                     return answer.skipped ? undefined : answer.value?.trim();
@@ -2195,9 +2265,15 @@ export function createTools(ctx) {
                 },
                 remember: noteSensitiveAnswer,
             });
-            const passwordOutcome = { ...told, ...(told.status === 'saved' ? { proven: true } : {}) };
-            if (told.status === 'skipped' || told.status === 'login')
+            const passwordOutcome = { ...told, ...(told.status === 'saved' || told.status === 'opened' ? { proven: true } : {}) };
+            if (told.status === 'skipped' || told.status === 'login' || told.status === 'opened')
                 passwordStands.set(site, passwordOutcome);
+            if (told.status === 'opened') {
+                // The site is public now: its previews open with nothing sent.
+                hostedPreviewProven = true;
+                provenHost = 'Netlify';
+                provenPattern = pattern ?? provenPattern;
+            }
             if (value) {
                 // What is in hand follows the store: a new password is the one saved now, and the site the last one opened no longer stands.
                 sitePassword = value;

package/dist/vercel.js

@@ -110,7 +110,7 @@ export async function readVercelProject(vercel, link) {
     const branch = record(project.link)?.productionBranch;
     const protection = scope(project);
     const hosts = [target, ...latest].flatMap((d) => (typeof d?.url === 'string' && d.url ? [d.url.replace(/^https?:\/\//, '').toLowerCase()] : []));
-    return { production: exists ? 'exists' : 'none', ...(typeof branch === 'string' && branch ? { productionBranch: branch } : {}), protection: typeof protection === 'string' ? protection : null, deploymentHosts: new Set(hosts) };
+    return { ...(typeof project.name === 'string' && project.name ? { name: project.name } : {}), production: exists ? 'exists' : 'none', ...(typeof branch === 'string' && branch ? { productionBranch: branch } : {}), protection: typeof protection === 'string' ? protection : null, deploymentHosts: new Set(hosts) };
 }
 /**
  * The linked project before its first push: read through `vercel api`, and, with no production deployment, locked
@@ -118,15 +118,17 @@ export async function readVercelProject(vercel, link) {
  * branch it builds and Standard Protection serves production domains to anyone. A project that deploys production
  * already (live or building), or is locked already, is left as it is.
  */
-export async function prepareFirstDeployment(vercel, link) {
+export async function prepareFirstDeployment(vercel, link, lock = true) {
     const project = await readVercelProject(vercel, link);
     if (!project)
         return { production: 'unknown', locked: false, reason: 'The Vercel CLI could not read the project (vercel api): it is signed out, or this CLI has no api command.' };
-    const branch = project.productionBranch ? { productionBranch: project.productionBranch } : {};
+    const branch = { ...(project.productionBranch ? { productionBranch: project.productionBranch } : {}), ...(project.name ? { project: project.name } : {}) };
     if (project.production === 'exists')
         return { production: 'exists', ...branch };
     if (project.protection === 'all')
         return { production: 'none', locked: true, ...branch };
+    if (!lock)
+        return { production: 'none', locked: false, ...branch, reason: "Vercel's login is not in front of the project's addresses yet." };
     try {
         if (scope(await printedProject(vercel, lockProjectApi(link))) === 'all')
             return { production: 'none', locked: true, ...branch };
@@ -136,6 +138,28 @@ export async function prepareFirstDeployment(vercel, link) {
     }
     return { production: 'none', locked: false, ...branch, reason: "Vercel did not put its login in front of the project's addresses: that takes the Member role or Project Administrator." };
 }
+/**
+ * A page of the project in Vercel's dashboard: by its team and name when the run knows both, else the dashboard's link
+ * that has the person pick them.
+ */
+export function vercelProjectPage(page, team, project) {
+    return team && project ? `https://vercel.com/${encodeURIComponent(team)}/${encodeURIComponent(project)}/${page}` : `https://vercel.com/d?to=${encodeURIComponent(`/[team]/[project]/${page}`)}`;
+}
+/** Reads the project again every `wait.everyMs` until Vercel's login stands in front of every address of it, or it deploys production, or `wait.totalMs` has passed (a read that failed counts as neither): the person is locking it meanwhile. */
+export async function waitForVercelLock(vercel, link, deps) {
+    for (const end = Date.now() + deps.wait.totalMs;;) {
+        const first = await prepareFirstDeployment(vercel, link, false);
+        // A read that failed says nothing yet, so the wait goes on.
+        if (first.production === 'exists' || first.locked || Date.now() >= end || deps.signal?.aborted)
+            return first;
+        try {
+            await (deps.sleep ?? ((ms) => sleep(ms, undefined, { signal: deps.signal })))(deps.wait.everyMs);
+        }
+        catch {
+            return first;
+        }
+    }
+}
 /**
  * The hosts of the linked project's deployments while Vercel's login stands in front of every address of it, read
  * now: a Production deployment GitHub lists for a pushed branch is its preview only when it is one of these. Empty

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,